[libipset] How to read packet counter of a single item?

[libipset] How to read packet counter of a single item?

[U.Mutlu]

Hi,

1) Which libipset function can be used for getting
the packet counter value of a single entry in the set/list?

Using the function ipset_parse_line(ips, line) I can issue
most of the ipset functions, but I need also a method
for getting the packet counter for just a single item only,
ie. not the output of all items as "ipset save" does.
I need to do this in C/C++ (hence libipset in Linux), ie. not in script.


2) man ipset says
"test SETNAME TEST-ENTRY [ TEST-OPTIONS ]
    Test whether an entry is in a set or not. Exit status number is zero if 
the tested entry is in the set and nonzero if it is missing from the set."

But the TEST-OPTIONS are not further described or documented.
What test options are possible?

Re: [libipset] How to read packet counter of a single item?

[Jozsef Kadlecsik]

Hi,

On Fri, 13 Oct 2023, U.Mutlu wrote:

> 1) Which libipset function can be used for getting
> the packet counter value of a single entry in the set/list?
> 
> Using the function ipset_parse_line(ips, line) I can issue most of the 
> ipset functions, but I need also a method for getting the packet counter 
> for just a single item only, ie. not the output of all items as "ipset 
> save" does. I need to do this in C/C++ (hence libipset in Linux), ie. 
> not in script.

There is no such functionality in ipset. You can test the existence of an 
element in a set or list/save all of them with all of the attached 
attributes.

> 2) man ipset says
> "test SETNAME TEST-ENTRY [ TEST-OPTIONS ]
>    Test whether an entry is in a set or not. Exit status number is zero if the
> tested entry is in the set and nonzero if it is missing from the set."
> 
> But the TEST-OPTIONS are not further described or documented.
> What test options are possible?

There's a single one in the case of list:set: to test the element before 
or after a reference one.

Best regards,
Jozsef
-- 
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.hu
PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: [libipset] How to read packet counter of a single item?

[U.Mutlu]

Jozsef Kadlecsik wrote on 10/13/23 21:05:
> On Fri, 13 Oct 2023, U.Mutlu wrote:
>
>> 1) Which libipset function can be used for getting
>> the packet counter value of a single entry in the set/list?
>>
>> Using the function ipset_parse_line(ips, line) I can issue most of the
>> ipset functions, but I need also a method for getting the packet counter
>> for just a single item only, ie. not the output of all items as "ipset
>> save" does. I need to do this in C/C++ (hence libipset in Linux), ie.
>> not in script.
>
> There is no such functionality in ipset. You can test the existence of an
> element in a set or list/save all of them with all of the attached
> attributes.

I guess you mean just the ipset command line tool, whereas I explicitly stated 
libipset.

After researching it further I think it should be possible to read
the counter of a single item via libipset & co.,
or at least testing the item for having a counter value "gt" etc,
as is already possible in the iptables extensions, ie.
"-m set --packets-gt value" etc.

>> 2) man ipset says
>> "test SETNAME TEST-ENTRY [ TEST-OPTIONS ]
>>     Test whether an entry is in a set or not. Exit status number is zero if the
>> tested entry is in the set and nonzero if it is missing from the set."
>>
>> But the TEST-OPTIONS are not further described or documented.
>> What test options are possible?
>
> There's a single one in the case of list:set: to test the element before
> or after a reference one.

Can you give a practical example for this?

Re: [libipset] How to read packet counter of a single item?

[Jozsef Kadlecsik]

On Sat, 14 Oct 2023, U.Mutlu wrote:

> Jozsef Kadlecsik wrote on 10/13/23 21:05:
> > On Fri, 13 Oct 2023, U.Mutlu wrote:
> > 
> > > 1) Which libipset function can be used for getting
> > > the packet counter value of a single entry in the set/list?
> > > 
> > > Using the function ipset_parse_line(ips, line) I can issue most of the
> > > ipset functions, but I need also a method for getting the packet counter
> > > for just a single item only, ie. not the output of all items as "ipset
> > > save" does. I need to do this in C/C++ (hence libipset in Linux), ie.
> > > not in script.
> > 
> > There is no such functionality in ipset. You can test the existence of an
> > element in a set or list/save all of them with all of the attached
> > attributes.
> 
> I guess you mean just the ipset command line tool, whereas I explicitly 
> stated libipset.

No, the functionality is missing both from the kernel and the user parts. 
Have a look at the ip_set_utest() function in the kernel which answers the 
test requests: just an error/success code is returned to userspace and 
nothing else. While the dump function (for save/restore) works for whole 
sets only. There is no "get_element" like functionality.

> After researching it further I think it should be possible to read the 
> counter of a single item via libipset & co., or at least testing the 
> item for having a counter value "gt" etc, as is already possible in the 
> iptables extensions, ie. "-m set --packets-gt value" etc.

That is for the kernel match functions to find matching elements in the 
sets with given criteria.
 
> > > 2) man ipset says
> > > "test SETNAME TEST-ENTRY [ TEST-OPTIONS ]
> > >     Test whether an entry is in a set or not. Exit status number is zero
> > > if the
> > > tested entry is in the set and nonzero if it is missing from the set."
> > > 
> > > But the TEST-OPTIONS are not further described or documented.
> > > What test options are possible?
> > 
> > There's a single one in the case of list:set: to test the element before
> > or after a reference one.
> 
> Can you give a practical example for this?

I can give you an example but I don't think it's practical.

# Create a few sets
ipset n hosts hash:ip
ipset n nets hash:net
ipset n hostswithports hash:ip,port
ipset n netswithports hash:net,port

# "Aggregate" them in one single set so that you can refer them
# in a singe ip[6]tables rule
ipset n access list:set
ipset a access netswithports
ipset a access hostswithports
ipset a access nets
ipset a access hosts 

# If you want to make sure the order is right in the "access" set
# ... but listing is more straightforward
ipset t access nets before hosts		# returns ture
ipset t access nets before hostswithports	# returns false

Best regards,
Jozsef
-- 
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.hu
PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics
          H-1525 Budapest 114, POB. 49, Hungary